@Lucas_K Please share the solution if you were able to solve this?  ... View more

Make sure you restarted the Search Head after you initialized Search Head Clustering   ... View more

you are right, there no data with this key-value pair i.e. user=value many thanks for your support! ... View more

it is possible to use custom index ?,could someone answer this? ... View more

it is also very important to apply the changes by MC (button in the top right) ... View more

Thankyou everyone that's posted a response here, you gave me various options and areas to check that I'd renamed my server correctly. However I still had no license usage reports as the license master was still finding the old servername somewhere. The final piece for me was finding the entries in the assets.csv file which corrected the license master name in the Monitoring Console dash/reports.... ... View more

But I'm pretty sure that's the wrong syntax. "-mode slave" assigns an indexer to the indexer cluster. And search heads don't do replication to an index cluster so replication_port makes no sense. The command should be: ./splunk edit cluster-config -mode searchhead -site site0 -master_uri https://:8089 -secret pass123 Ref: https://docs.splunk.com/Documentation/Splunk/6.4.1/DistSearch/SHCandindexercluster ... View more

for me works as folowing. index="XXX" sourcetype="XXX" source=XXXX Host="10.*" Risk_Factor!="None" | stats cont by Risk_Factor | sort by -Risk_Factor |head 3 "| some statistic" .. done, so I'm Know that I'm very late, but it works ... View more